1. Revenue Mismatches Between VAT and Corporate Tax Returns
The FTA's automated systems cross-reference revenue reported on VAT returns with revenue declared on corporate tax returns. Discrepancies are flagged automatically. If your VAT returns show AED 5 million in taxable supplies but your corporate tax return reports AED 3 million in revenue, expect a letter.
2. QFZP Claims Without Proper Documentation
Free zone companies claiming 0% qualifying income must demonstrate compliance with all QFZP conditions — substance, qualifying income tests, audited financial statements (now mandatory regardless of revenue) and transfer pricing documentation. Claims without supporting evidence are high-priority audit targets.
3. Related-Party Transactions Without Transfer Pricing Documentation
Transactions with related parties that lack contemporaneous documentation are a red flag. The larger the value, the higher the risk. Companies exceeding AED 40 million in aggregate related-party transactions must maintain Local File and Master File documentation.
4–7: Other Triggers
4. Late or incorrect registration — companies that registered late face automatic penalty exposure and heightened scrutiny. 5. Inconsistent customs data — import values that don't match reported costs of goods sold. 6. Large or unusual deductions — extraordinary expense claims, especially in the first filing year. 7. Industry-specific targeting — the FTA conducts sector-focused campaigns, with real estate, trading and professional services among the sectors receiving attention in 2026.
The best protection against audit risk is not avoidance — it is preparation. Bookkeeping that is audit-ready from day one, financial statements that reconcile with tax returns, and AML compliance records that demonstrate proper governance all reduce both the probability of audit selection and the risk of adverse findings if selected.
Related Insights
UAE Corporate Tax: The Second Filing Season and the Compliance Traps That Catch BusinessesFTA audit capacity increased 135% in 2024. QFZP mandatory audits now apply to all free zone entities. The penalty framew... Transfer Pricing in the UAE: The Documentation Rules Every Group Company Must FollowThe arm's length principle applies to all related-party transactions. Companies exceeding AED 40 million in group transa... The Death of the Traditional Corporate Service ProviderThe market for corporate services is bifurcating: large multinational providers and licensed boutiques. The middle — unl...How the FTA Selects Returns for Audit
The Federal Tax Authority does not audit at random. Selection is risk-scored: returns are run through an analytics engine that compares declared figures against peer benchmarks (by industry code), prior-period filings, third-party data (banking, customs, real-estate registry, immigration records for declared employees), and free-form intelligence — anonymous reports, supplier disputes, leaked invoices. A return with a high anomaly score is flagged for desk review; only a subset of desk reviews escalate to a full field audit. In practice, the trigger that moves a case from "score" to "letter" is almost always a specific inconsistency the engine cannot reconcile, not the absolute size of the company.
The Eleven Most Common Red Flags
| Pattern | Why it triggers | Mitigation |
|---|---|---|
| Persistent losses without commercial logic | Inconsistent with going-concern declarations | Substantiate with transfer-pricing or restructuring documentation |
| Gross margin far below industry median | Engine flags revenue under-statement or expense inflation | Maintain pricing files and supplier contracts |
| Related-party transactions ≥AED 40m undisclosed | Mandatory TP schedule missing | File TP disclosure with the CT return |
| Cash sales > 30% of revenue in B2B sector | Possible under-declaration of taxable supplies | Reconcile POS to bank deposits monthly |
| Free-zone QFZP claim with high mainland customer base | Suggests non-qualifying income exceeds de minimis | Track qualifying vs non-qualifying revenue per invoice |
| Director salaries above market without payroll records | Possible disguised distribution | Run formal payroll via WPS, board minutes for bonuses |
| VAT input-recovery without supporting tax invoices | Recoverable inputs cannot be substantiated | Maintain compliant tax invoices for 5 years |
| Significant year-over-year revenue drop after registration | Possibly fragmented to stay under SBR threshold | Substantiate commercial reasons with contracts |
| Inter-company loans without arm's-length interest | TP non-compliance | Benchmark interest using comparables |
| Use of small business relief by entity with >AED 3m turnover | Direct breach of eligibility | Run quarterly revenue projection |
| Foreign permanent establishment income not reported | Disclosure gap | Map all overseas activity to UAE consolidation |
What Happens After a Letter Arrives
An FTA audit letter typically allows 10 to 30 business days to respond. The response is usually a request for documentation: trial balance, general ledger, supporting invoices for sampled transactions, transfer pricing files, contracts and bank statements. The single largest determinant of audit outcome is whether records exist in a form that can be produced quickly and reconciled. Companies that respond with cleanly-organised digital files typically close audits with little or no adjustment; companies that scramble to recreate ledgers attract additional sampling and penalty multipliers for inadequate record-keeping.
The five-year record-keeping requirement under Federal Decree-Law 47 of 2022 is not a soft target. Records must be retrievable in a format that supports reconciliation — Excel workbooks tied to source documents, with cross-references to the CT return as filed. The single change that most reduces audit risk is moving bookkeeping out of unstructured folders and into an accounting system whose outputs feed directly into EmaraTax.
Penalties: What's Actually At Stake
Where an audit finds a shortfall, the financial exposure is rarely the tax itself. The penalty stack — 15% of the shortfall for a first error rising to 75% where the FTA finds deliberate misstatement, plus 14% annual late-payment interest from the original due date — is what makes audits expensive. A AED 200,000 understated liability discovered three years late typically settles at over AED 350,000 once penalties and interest compound. For directors with personal liability exposure under AML and DNFBP obligations, audit findings can also feed downstream regulatory inquiries.
- FTA audits are risk-scored, not random — anomalies, not size, drive selection.
- Most triggers are reconcilable in advance: maintain TP files, track QFZP qualifying revenue, document inter-company terms.
- Five-year record retention is a legal requirement, not a guideline — records must be reconcilable, not just stored.
- Penalty exposure typically exceeds the underlying tax by 1.5–2× once interest compounds.
- Voluntary disclosure within 1 year of discovering an error is materially cheaper than an FTA-initiated finding.
Polaris Perspective
Polaris manages tax compliance for clients across all UAE jurisdictions — ensuring filings are internally consistent, properly documented and audit-ready before they reach the FTA.
Arrange a Consultation →